News for hackers. Stuff that matters.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by magashna on Thursday October 17, 2019 @01:39PM (#21284443)
You can't do anything but let it publicly fail. These incompetencies are usually the result of the top not believing that the cost is worth it. Also a well run IT department often gets "nothing's ever broken, what do they actually do?" so you get rewarded for doing break/fix.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by matthewaveryusa on Thursday October 17, 2019 @02:04PM (#21284753)
Reminds me of this quote in the preface of the art of war edition I have on my bookshelf -- I find it to be a fantastic little story:

According to an ancient Chinese parable, a lord once asked his physician – whose two brothers were also healers – which of the three was the most skilled. This doctor was renowned for his expertise and ability in healing throughout China, and he replied, “My eldest brother sees the spirit of sickness and removes it before it takes shape, so his name does not get out of the house. My elder brother cures sickness when it is still extremely minute, so his name does not get out of the neighborhood. As for me, I puncture veins, prescribe potions and massage skin, so my name gets out and is heard among the lords.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by toomuchtodo on Thursday October 17, 2019 @01:41PM (#21284460)
I am an infosec professional who pitches utilities and public government. This is spot on.

The second call back is always more expensive for them, but sometimes someone needs to touch the stove themselves to see it’s hot.

If you genuinely can’t afford it, I’ll help for free, but there’s only so much time in the day and I won’t eat the cost of stupid or politics.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by ben_jones on Thursday October 17, 2019 @01:47PM (#21284531)
Is it not also because the government contracting system is FUBAR? I.e. only certain kinds of companies can contract on the big projects, you need certain clearances for certain kinds of works, and the pay gap between public and private sector SWE & security?

Also aren't their some pretty tough mandates like x% of companies must be minority owned etc. I imagine it allows those companies to charge extortionist rates because they hit the relevant quotas and nobody else does.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by lliamander on Thursday October 17, 2019 @02:43PM (#21285134)
My first job out of college was working for a IT consulting firm on a project for a state government. All of this describes that experience precisely.

> Also aren't their some pretty tough mandates like x% of companies must be minority owned etc. I imagine it allows those companies to charge extortionist rates because they hit the relevant quotas and nobody else does.

One thing I saw was that the big players will have employees who fit the desired characteristics, and they just spin those employees off into their own corporation as needed.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by iguy on Thursday October 17, 2019 @01:54PM (#21284617)
Many of these complaints would apply to physical safety too. But we don't just wait for buildings to burn down to teach organizations a lesson about their heating contractors -- we have fire codes, and inspectors with teeth.

Is there any chance that something like this might be done for IT? Or is it all too young to be done sensibly?

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by wcip on Thursday October 17, 2019 @02:19PM (#21284924)
>But we don't just wait for buildings to burn down to teach organizations a lesson about their heating contractors -- we have fire codes, and inspectors with teeth.

We did wait for a fire to create building codes, it just was a long time before either of us were born: https://en.m.wikipedia.org/wiki/Triangle_Shirtwaist_Factory_...

There was certainly plenty of fires before that but this one was terrible enough to cause a public outcry.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by iguy on Wednesday October 23, 2019 @05:58PM (#21339488)
Sure, I agree that fire rules are written in blood. But not the blood of every single district. Once we've decided, we impose these rules across many cities, millions of buildings.

An individual city council is not free to learn the lessons again the hard way, no matter how tight the budget and how close the elections. Either it meets the code, or it gets closed down.